tetragon: Change enforcer programs pin path

We have the hierarchy in sysfs tree, so we don't nede the 'enforcer' prefix for kprobe program. Also adding 'fmod_ret_' prefix for fmod_ret programs, like: ./kill-syscalls ./kill-syscalls/__enforcer__ ./kill-syscalls/__enforcer__/fmod_ret___ia32_sys_dup ./kill-syscalls/__enforcer__/fmod_ret___ia32_sys_dup/prog ./kill-syscalls/__enforcer__/fmod_ret___x64_sys_dup2 ./kill-syscalls/__enforcer__/fmod_ret___x64_sys_dup2/prog ./kill-syscalls/__enforcer__/fmod_ret___x64_sys_dup ./kill-syscalls/__enforcer__/fmod_ret___x64_sys_dup/prog Signed-off-by: Jiri Olsa <[email protected]>
cilium · Sep 14, 2024 · 79f43bb · 79f43bb
1 parent f3087bc
commit 79f43bb
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/pkg/sensors/tracing/enforcer.go b/pkg/sensors/tracing/enforcer.go
@@ -276,7 +276,6 @@ func (kp *enforcerPolicy) createEnforcerSensor(
 		return nil, err
 	}
 
-	pinPath := sensors.PathJoin(name, "enforcer_kprobe")
 	switch overrideMethod {
 	case OverrideMethodReturn:
 		useMulti := !specOpts.DisableKprobeMulti && !option.Config.DisableKprobeMulti && bpf.HasKprobeMulti()
@@ -292,7 +291,7 @@ func (kp *enforcerPolicy) createEnforcerSensor(
 			path.Join(option.Config.HubbleLib, prog),
 			attach,
 			label,
-			pinPath,
+			"kprobe",
 			"enforcer").
 			SetLoaderData(policyName)
 
@@ -305,7 +304,7 @@ func (kp *enforcerPolicy) createEnforcerSensor(
 				path.Join(option.Config.HubbleLib, "bpf_fmodret_enforcer.o"),
 				syscallSym,
 				"fmod_ret/security_task_prctl",
-				pinPath,
+				fmt.Sprintf("fmod_ret_%s", syscallSym),
 				"enforcer").
 				SetLoaderData(policyName)
 			progs = append(progs, load)